MacOS – How to start pfctl at boot

firewallmacos

Before El Capitan I used to enable pfctl at boot by adding -e to the start up parameters.

In /System/Library/LaunchDaemons/com.apple.pfctl.plist

<string>/sbin/pfctl</string>
<key>ProgramArguments</key>
<array>
    <string>pfctl</string>
    <string>-e</string>                <---- this line
    <string>-f</string>
    <string>/etc/pf.conf</string>
</array>

Now I am not able to edit the file anymore (because of System Integrity Protection).

Is there a way to achieve the same without disabling System Integrity Protection?

Best Answer

Is there a way to achieve the same without disabling System Integrity Protection?

Yes*, in System Preferences / Security & Privacy / Firewall Options..., check "Enable stealth mode" and turn on Firewall.

Somehow this enables PF. You can check by running sudo pfctl -s info.

*Tested on High Sierra and Mojave